ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    CentOS7 Server Apache Disable old TLS for higher versions

    IT Discussion
    tls tls 1.2 tls 1.0 apache httpd
    4
    12
    2.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Alex Sage @Alex Sage
      last edited by Alex Sage

      Seems like you should disable everything except TLS 1.2 unless you need to support something that doesn't support 1.2 TLS

      0_1538506991940_c4ebcf7a-bfd6-43ec-a7d9-74b7fdadf6dc-image.png

      https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-hardening_tls_configuration

      Could you put Cloudflare or nginx in front of this?

      DustinB3403D 1 Reply Last reply Reply Quote 0
      • DustinB3403D
        DustinB3403 @Alex Sage
        last edited by

        @aaronstuder said in CentOS7 Server Apache Disable old TLS for higher versions:

        So to be clear you want to disable TLS v1.0 and allow everything from TLS 1.1 up?

        Yea

        1 Reply Last reply Reply Quote 0
        • DustinB3403D
          DustinB3403 @Alex Sage
          last edited by DustinB3403

          @aaronstuder said in CentOS7 Server Apache Disable old TLS for higher versions:

          Could you put Cloudflare or nginx in front of this?

          No, this isn't hosted in a manner in which this wouldn't be viable. (read as outside of my control).

          A 1 Reply Last reply Reply Quote 0
          • A
            Alex Sage @DustinB3403
            last edited by

            @dustinb3403 Got ya, that's why I asked 😉

            1 Reply Last reply Reply Quote 0
            • A
              Alex Sage
              last edited by

              This looks OK, but I haven't tested it.

              https://www.cloudibee.com/disabling-tls-apache/

              I would check it with SSL Labs after you disable it.

              https://www.ssllabs.com/

              1 Reply Last reply Reply Quote 1
              • JaredBuschJ
                JaredBusch @DustinB3403
                last edited by

                @dustinb3403 said in CentOS7 Server Apache Disable old TLS for higher versions:

                So the question has just come to me, how can I disable TLS v1 and force higher versions of TLS running on a CentOS 7 VM running an apache website.

                I often don't bother with public facing things and thus never really look into this. So I'm looking for guidance / confirmation.

                This appears to be the answer and than just wait a bit so the Interwebz can realize this change has been made.

                Any additional guidance?

                Yes, for Apache, that is pretty much it. You update your SSLProtocol as needed and restart the service.

                1 Reply Last reply Reply Quote 2
                • coliverC
                  coliver
                  last edited by

                  @DustinB3403 I really like this site for information on securing various web servers.

                  https://cipherli.st/

                  JaredBuschJ 1 Reply Last reply Reply Quote 0
                  • JaredBuschJ
                    JaredBusch @coliver
                    last edited by

                    @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                    @DustinB3403 I really like this site for information on securing various web servers.

                    https://cipherli.st/

                    I just implemented their Nginx setting but getting back that TLSv1 was accepted?

                    https://www.ssllabs.com/ssltest/analyze.html?d=naggaroth.daerma.com

                    coliverC 1 Reply Last reply Reply Quote 0
                    • coliverC
                      coliver @JaredBusch
                      last edited by

                      @jaredbusch said in CentOS7 Server Apache Disable old TLS for higher versions:

                      @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                      @DustinB3403 I really like this site for information on securing various web servers.

                      https://cipherli.st/

                      I just implemented their Nginx setting but getting back that TLSv1 was accepted?

                      https://www.ssllabs.com/ssltest/analyze.html?d=naggaroth.daerma.com

                      First line should read TLS1.2 if you don't have a version of Nginx that supports 1.3.

                      JaredBuschJ 1 Reply Last reply Reply Quote 0
                      • JaredBuschJ
                        JaredBusch @coliver
                        last edited by

                        @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                        @jaredbusch said in CentOS7 Server Apache Disable old TLS for higher versions:

                        @coliver said in CentOS7 Server Apache Disable old TLS for higher versions:

                        @DustinB3403 I really like this site for information on securing various web servers.

                        https://cipherli.st/

                        I just implemented their Nginx setting but getting back that TLSv1 was accepted?

                        https://www.ssllabs.com/ssltest/analyze.html?d=naggaroth.daerma.com

                        First line should read TLS1.2 if you don't have a version of Nginx that supports 1.3.

                        Correct. That is the only change I made to their config. I even reran dhparam

                        1 Reply Last reply Reply Quote 0
                        • 1 / 1
                        • First post
                          Last post